SCIM directory sync, now for every Kinde business

Sync users automatically with SCIM

Keep users in sync with your customers’ identity providers automatically. SCIM directory sync is now available to every Kinde business, with no need to contact support. When a customer adds, updates, suspends or removes someone in Entra ID, Okta or another SCIM-compatible provider, Kinde updates the user for you.

You’ll find the Provisioning menu, with its Directory and Logs pages, in each organization. Each change raises a user.updated webhook with the source scim, so your own systems can react to automatic deprovisioning. A SCIM DELETE suspends the user rather than deleting them, so re-provisioning later reattaches to the same Kinde user. We also fixed a bug that stopped some users from being deleted via SCIM or the API.

See and manage plan versions

You can now see every published version of a billing plan, open older versions, and start a new draft from any of them. Each time you publish a plan, Kinde saves it as a new version. Existing subscribers stay on their version, so publishing only affects new sign-ups. The Plans list shows which version each plan is on, and the new versions page lists every version with its subscriber count, pricing and published date. Published versions are read-only apart from their name and description. To change one or roll back, use Save as draft to copy it into a new editable draft.

Pricing tables always sell the latest published version, and each plan in a pricing table now shows which version that is. When you publish, the confirmation dialog lists any pricing tables affected. Checkout, invoices, entitlements, webhooks and the Management API also now consistently use the published version, so draft edits never reach your customers.

Let subscribers cancel at the end of their billing period

Plans have a new Cancellation takes effect setting, so cancellations can apply immediately or at the end of the current billing period. The subscription stays active until then, and customers can change their mind with Keep plan in the self-serve portal. Billing admins can keep the plan or cancel immediately from the organization’s billing page, and the Management API supports scheduling and reverting cancellations. Existing plans still cancel immediately unless you change the setting.

Organization-managed roles and permissions (Kinde Scale plans)

On the Scale plan, each organization can now define its own roles and permissions, kept separate from every other organization. Before this, all roles were business-wide. A custom role such as “billing approver” for one customer was visible to, and assignable in, every organization. Org-managed roles and permissions belong to a single organization and environment, with up to 100 per organization. You can manage them from the organization’s Roles tab, the Management API (/api/v1/organizations/{org_code}/roles and /permissions), or the self-serve portal. Webhooks now include organization_code for org-owned roles and permissions. Role keys sent when adding or updating organization users are now validated up front, and invalid keys return INVALID_ROLES instead of being silently dropped. If you move below Scale, existing assignments are kept but hidden from tokens, permission checks, webhooks and lists until you upgrade again.

Approve and revoke AI agent access (available on request)

AI agents and MCP applications can now ask users for approval before connecting. This feature is available on request. Contact support to have it enabled for your business. Once it’s on, you can turn on Ask users to approve agents for any agent or MCP application.

When this is on, users see a consent screen before agents like Claude, ChatGPT or Cursor get access. Approvals are remembered for 30 days. Users can revoke an agent from Connected apps in the account portal. Admins can revoke one or all approvals from the new Agent access tab.

We’ve also made improvements to agent and MCP applications that apply to everyone. Sign-in to these applications through Entra ID, SAML, OAuth 2.0 and WS-Fed connections now works correctly. The issuer path for this application type has moved to /oauth2/agents/{id}. MCP connections now keep users’ grants in step when you re-upload an OpenAPI spec, so connected agents pick up new tools and no longer get stuck re-authenticating.

Safer email trust for social and SSO connections

The “Trust email addresses” switch has been replaced with three options:

• Don’t trust: never merge on email

• Verify, then trust: merge only after the user confirms the email with a one-time code

• Trust: merge immediately

This lets you keep automatic account linking without the account-takeover risk of trusting a provider that doesn’t verify emails.

The new trust_mode option is also available in the Management API, and is_trusted is now deprecated. On custom OAuth 2.0 connections, a warning now appears next to the Trust option to remind you to only choose it if the provider verifies email addresses.

Know when SSO connections and email sending break

Kinde now shows a banner on your dashboard and status page when something you need to fix is broken. For enterprise SSO connections, this covers problems like an expired or wrong Entra ID client secret, an unknown app or tenant ID, or a SAML signing certificate expiring within 30 days. For custom SMTP email senders, it covers your server rejecting sends, which often happens after a password change. The Email sender page shows the error and when it happened. Both alerts clear automatically once the issue is fixed. This helps you avoid finding out from your customers that sign-ins or one-time code emails have stopped working.

Billing improvements

Self-serve portal customers can now only get one free trial. Admin plan assignments aren’t restricted, and POST /api/v1/billing/agreements has a new optional skip_trial flag. Other billing changes include:

• Change plans during sign-up: a new “Select other plan” link on the payment details page lets users go back and pick a different plan

• Clearer errors: payment-step failures now show specific error codes and messages, translated into all supported languages

• Cancellation workflows: plan cancellation workflows now receive the billing customer ID

• Card fixes: we fixed issues with older cards that have no billing country and with plan upgrades charging the wrong card

Self-serve portal updates

Organization members and invitations in the self-serve portal are now available to every business. You can enable them in Settings → Self-serve portal and Environment → Policies. Portal sessions now stay alive while the page is open. Sessions end after 10 minutes of inactivity rather than 10 minutes after sign-in, and expired sessions now redirect users to sign in again instead of clicks silently failing.

Security improvements

We’ve closed several security issues in sign-in and authorization:

• Wildcard redirect URIs: wildcard callback, CORS and logout URLs now match literally, so look-alike domains are rejected.

• Username accounts: create-account forms now refuse existing usernames, which closes an account takeover path.

• Password reset: the reset flow no longer reveals whether an email is registered when enumeration protection is on.

• MFA with acr_values=mfa: sign-ins using acr_values=mfa no longer force enrolment when your MFA policy wouldn’t ask for it.

• Deleted users: deleting a user now also removes their MFA enrolments.

• Firewall rules: firewall fingerprint rules now protect custom domains as well as *.kinde.com.

Minor fixes and enhancements

• Expired sign-in input screens (MFA, password, email verification, passkey) now show a clear “link expired” page instead of a confusing error

• New passwords set after signing in with an admin-issued temporary password are now saved correctly

• Invitation links that only include invitation_code are now treated as invitations

• Password managers now fill saved passwords on hosted sign-in pages

• Phone identities are now kept and confirmed when users set up a passkey after a phone code sign-in

• Phone sign-in SMS is no longer capped at 10 per month on Pro, Plus and Scale plans

• Faroe Islands (+298) added to the phone country list

• Custom OAuth 2.0 connections now explain when they’re unavailable on your plan

• Entra ID connections now check for required fields before they can be enabled

• A partial connections PATCH no longer resets stored options such as custom domain settings

• Saved SAML ACS URL overrides are now applied at sign-in

• Home realm discovery once again routes to shared SSO connections enabled for an organization

• Feature flags can no longer get out of sync with their overrides, and changing a flag’s type is refused while overrides are attached

• The webhooks list now supports paging, search and sort

• Directly assigned permissions now show on the user Permissions tab

• Audit logs load faster in large environments

• User search in large environments no longer times out

• Google Analytics sign-in tracking now works when Google signals is turned on

• The Account API docs now show the correct tenant base URL

• Custom domain certificates are now picked up reliably across all proxy servers

• Custom domains behind proxies like Cloudflare are no longer marked as churned

• Token requests in some regions are faster

SDKs

Here are this month’s SDK updates:

• NextJS SDK: Dependency updates, including the Kinde TypeScript SDK, React SDK, JWT decoder and JWT validator packages

• iOS SDK: Adds invitation code support for login and deep links, plus a new prompt parameter for login

• .NET SDK: Adds .NET 10 support and fixes connection APIs returning null details

• Management API JS SDK: Fixes type resolution under node16/nodenext, adds new billing, directory secret rotation and identity lookup endpoints, and changes meter_value to a number (breaking)

• Remix SDK: Maintenance release with dependency and tooling updates, with no changes to the public API

• JWT Decoder SDK: Updated development dependencies and tooling, with no customer-facing changes

• Webhook SDK: Updated JWT validator and decoder dependencies, plus routine tooling upgrades

• JWT Validator SDK: Fixed a regression from 0.4.5 that broke Cloudflare Workers by restoring lazy loading of jsrsasign

• JS Utils SDK: Updated jwt-decoder dependency and applied security patches to transitive dependencies

• Expo SDK: Token revocation on logout added via logout({ revokeToken: true })

• TanStack Router SDK: Token verification fixes and an update to @kinde/js-utils v0.32.1

• Terraform Provider: Upgraded Go toolchain and Terraform plugin dependencies and expanded documentation, with no configuration changes needed

Subscribe to feature releases

Subscribe to items on our roadmap and find out first when the features you want are available to use! View the roadmap.

Find your community on Slack or Discord

Join the Kinde community on Slack or the Kinde community on Discord for support and advice from our team and other legends working with Kinde.